WisperNet: Anti-Jamming for Wireless Sensor Networks

Transcription

1 University of Pennsylvania ScholarlyCommons Real-Time and Embedded Systems Lab (mlab) School of Engineering and Applied Science --28 WisperNet: Anti-Jamming for Wireless Sensor Networks Miroslav Pajic University of Pennsylvania, Rahul Mangharam University of Pennsylvania, Follow this and additional works at: Recommended Citation Miroslav Pajic and Rahul Mangharam, "WisperNet: Anti-Jamming for Wireless Sensor Networks",. January 28. Suggested Citation: Pajic, M. and Mangharam, R. (28). WisperNet: Anti-Jamming for Wireless Sensor Networks. 2nd Workshop on Embedded Systems Security (WESS 8), IEEE/ACM EMSOFT 28 and the Embedded Systems Week. 28 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. This paper is posted at ScholarlyCommons. For more information, please contact

2 WisperNet: Anti-Jamming for Wireless Sensor Networks Abstract Resilience to electromagnetic jamming and its avoidance are difficult problems. It is often both hard to distinguish malicious jamming from congestion in the broadcast regime and a challenge to conceal the activity patterns of the legitimate communication protocol from the jammer. In the context of energy-constrained wireless sensor networks, nodes are scheduled to maximize the common sleep duration and coordinate communication to extend their battery life. This results in well-defined communication patterns with possibly predictable intervals of activity that are easily detected and jammed by a statistical jammer. We present an antijamming protocol for sensor networks which eliminates spatio-temporal patterns of communication while maintaining coordinated and contention-free communication across the network. Our protocol, WisperNet, is time-synchronized and uses coordinated temporal randomization for slot schedules and slot durations at the link layer and adapts routes to avoid jammers in the network layer. Through analysis, simulation and experimentation we demonstrate that WisperNet reduces the efficiency of any statistical jammer to that of a random jammer, which has the lowest censorship-to-link utilization ratio. WisperNet is more energy efficient than low-power listen CSMA protocols such as B-mac and is simple to analyze in terms of effective network throughput, reliability and delay. WisperNet has been implemented on the FireFly sensor network platform. Comments Suggested Citation: Pajic, M. and Mangharam, R. (28). WisperNet: Anti-Jamming for Wireless Sensor Networks. 2nd Workshop on Embedded Systems Security (WESS 8), IEEE/ACM EMSOFT 28 and the Embedded Systems Week. 28 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. This conference paper is available at ScholarlyCommons:

3 WisperNet: Anti-Jamming for Wireless Sensor Networks Miroslav Pajic and Rahul Mangharam Department of Electrical and Systems Engineering University of Pennsylvania {pajic, ABSTRACT Resilience to electromagnetic jamming and its avoidance are difficult problems. It is often both hard to distinguish malicious jamming from congestion in the broadcast regime and a challenge to conceal the activity patterns of the legitimate communication protocol from the jammer. In the context of energy-constrained wireless sensor networks, nodes are scheduled to maximize the common sleep duration and coordinate communication to extend their battery life. This results in well-defined communication patterns with possibly predictable intervals of activity that are easily detected and jammed by a statistical jammer. We present an anti-jamming protocol for sensor networks which eliminates spatio-temporal patterns of communication while maintaining coordinated and contention-free communication across the network. Our protocol, WisperNet, is time-synchronized and uses coordinated temporal randomization for slot schedules and slot durations at the link layer and adapts routes to avoid jammers in the network layer. Through analysis, simulation and experimentation we demonstrate that WisperNet reduces the efficiency of any statistical jammer to that of a random jammer, which has the lowest censorship-to-link utilization ratio. WisperNet is more energy efficient than low-power listen CSMA protocols such as B-mac and is simple to analyze in terms of effective network throughput, reliability and delay. WisperNet has been implemented on the FireFly sensor network platform.. INTRODUCTION Jamming is the radiation of electromagnetic energy in a communication channel which reduces the effective use of the electromagnetic spectrum for legitimate communication. Jamming results in a loss of link reliability, increased energy consumption, extended packet delays and disruption of end-toend routes. Jamming may be both malicious with the intention to block communication of an adversary or non-malicious in the form of unintended channel interference. In the context of embedded wireless networks for time-critical and safety critical operation such as in medical devices and industrial control networks, it is essential that mechanisms for resilience to jamming are native to the communication protocol. Resilience to jamming and its avoidance, collectively termed as anti-jamming, is a hard practical problem as the jammer has an unfair advantage in detecting legitimate communication activity due to the broadcast nature of the channel. The jammer can then emit a sequence of electromagnetic pulses to raise the noise floor and disrupt communication. Communication nodes are unable to differentiate jamming signals from legitimate transmissions or changes in communication activity due to node movement or nodes powering off without some minimum processing at the expense of local and network resources. In the case of energy-constrained wireless sensor networks, nodes are scheduled to maximize the common sleep duration and coordinate communication to extend their battery life. With greater network synchronization, the communication is more energy-efficient as nodes wake up from low-power operation just before the common communication interval. Such coordination introduces temporal patterns in communication with predictable intervals of transmission activity. Channel access patterns make it efficient for a jammer to scan and jam the channel only during activity intervals. The jammer can time its pulse transmission to coincide with the preambles of packets from legitimate nodes and thus have a high censorship to channel utilization ratio while remaining difficult to detect. The jammer is thus able to exploit the temporal patterns in communication to disrupt a transmission of longer length of legitimate transmissions with a small set of jamming pulses. For nodes in fixed locations, a jammer can select regions with heavier communication activity or denser connectivity to increase the probability that a random jamming pulse results in corrupting an on-going transmission. Nodes in the proximity of the jammer will endure a high cost of operation in terms of energy consumption and channel utilization with a low message delivery rate. They must either physically relocate or increase the cost of their links so the network may adapt its routes. Methods for anti-jamming must therefore address threats due to both temporal patterns at the link layer and spatial distribution of routes in the network layer. Our goal is to reduce or eliminate spatio-temporal patterns in communication while maintaining energy-efficient, coordinated and collision-free operation in multi-hop wireless sensor networks. We achieve this by incorporating coordinated temporal randomization for slot schedules and slot durations between each node and its k-hop neighbors. This prevents the jammer from predicting the epoch and length of the next activity on the channel. Such mechanisms reduce the effectiveness of any statistical jammer to that of a random pulse jammer. While temporal randomization prevents statistical jammers from determining any useful packet inter-arrival distribution for preemptive attacks, it still has an efficiency of a random jammer and can achieve censorship which increases linearly with channel utilization and jamming activity. To avoid such random jammers which are co-located near nodes with active routes, we employ adaptive routing to select paths such that the highest possible end-to-end packet delivery ratios are achieved. We combine the above temporal and spatial schemes in a tightly synchronized protocol where legitimate nodes are implicitly

4 coordinated network-wide while ensuring no spatio-temporal patterns in communication are exposed to external observers. In the context of multi-hop embedded wireless networks, which are battery-operated and require low-energy consumption, we require the following properties from the anti-jamming protocol:. Non-predictable schedules: Transmission instances (e.g. slot assignments) are randomized and non-repeating to prevent the jammer from predicting the timing of the next slot based on observations of channel activity. In this way, even if the jammer successfully estimates slot sizes, it has to transmit pulse attacks at an interval of the average slot duration to corrupt communication between nodes. This is especially inefficient for networks with low channel utilization, which is the common case in sensor networks, when the jammer must expend several times more energy in jamming pulses to corrupt a single legitimate transmission. 2. Non-predictable slot sizes: Slots are randomly sized on a packet-by-packet basis in order to prevent the jammer from estimating the duration of channel activity for energy efficient reactive jamming. This requirement further reduces the jammer s lifetime as it will need to employ the smallest observed slot duration as its jamming interval. In addition, a reactive jammer which observes the channel for activity before emitting a jamming pulse, will only be effective in jamming the fraction of packets that are greater than a certain threshold length. 3. Coordinated and scheduled transmission: The communication schedule according to which a node transmits is known to all of its legitimate neighbors so they can wake up to receive the message during its transmission slot. This also prevents nodes from turning on their receiver when no legitimate activity is scheduled and hence reduces the likelihood of a jammer draining the energy of a node. The schedule must be determined implicitly without the need for frequent and explicit node-to-node control message exchange. This allows energy-efficient operation and increases lifetime of every node in the network. 4. Coordinated changes of slot sizes: All nodes must be aware of the current and next slot sizes. This is very important because any incompatibility or synchronization error would disable communication between legitimate nodes. 5. Collision-free transmission: Communication must satisfy the hidden terminal problem so that a transmit slot of a given node does not conflict with transmit slots of nodes within its k-hop interference range. With scheduled communication with randomized slot assignment, it is essential that scheduling conflicts are eliminated implicitly and incur no additional overhead. The rest of this paper is organized as follows: In Section 2, we provide a background and related work for energy efficient protocols and energy efficient jamming schemes. In Section 3, we provide an overview of the WisperNet anti-jamming protocol and describe the coordinated temporal randomization scheme. In Section 4, we describe the WisperNet coordinated spatial adaptation scheme. Section 5 describes our implementation experiences and experimental results followed by the conclusion. 2. BACKGROUND AND RELATED WORK To understand the inherent tradeoff between energy efficient link protocols with well-defined schedules and their susceptibility to jamming attacks, we first describe the different types of jammers and their impact on various types of link layer protocols. We then highlight a particular class of statistical jammers and their impact on energy-efficient sensor network link protocols. 2. Jammers and Trade-offs with Jamming 2.. Comparison of Jamming Models In [] and [2], Xu et al. introduce four common types of jammers: constant, random, reactive and deceptive. Constant jammers continually emit a jamming signal and achieve the highest censorship of packets corrupted to total packets transmitted. The constant jammer, however, is not energyefficient and can be easily detected and localized. The random jammer is similar to the constant jammer but operates at a lower duty cycle with intervals of sleep. A random jammer transmits a jamming signal at instances derived from a uniform distribution with a known minimum and maximum interval. The censorship ratio of the random jammer is constant and invariant to channel utilization. At low duty cycles, the random jammer is difficult to detect and avoid. A reactive jammer keeps its receiver always on and listens for channel activity. If a known preamble pattern is detected, the reactive jammer quickly emits a jamming signal to corrupt the current transmission. Reactive jammers, while effective in corrupting a large proportion of legitimate packets, are not energy efficient as the receiver is always on. A deceptive or protocolaware jammer is one that has knowledge of the link protocol being used and the dependencies between packet types. Such a jammer exploits temporal and sequential patterns of the protocol and is very effective. In [3], a statistical jamming model is described where the jammer first observes temporal patterns in channel activity, extracts a histogram of inter-arrival times between transmissions and schedules jamming pulses based on the observed distribution. This results in a very effective jammer that is not protocol-aware and is also difficult to detect. A statistical jammer chooses its transmission interval to coincide with the peak inter-arrival times and is thus able to maximize its censorship ratio with relatively little effort. Figure (a) illustrates the relative censorship ratio and the energy-efficiency of the different jammers. Figure (b) illustrates the relative stealth or difficulty in detection. We observe that the statistical jammer has a high censorship ratio with both energyefficient and stealthy operation and hence focus on combating such jamming in the remainder of this paper Techniques for Robust Transmission The traditional defenses against jamming include spread spectrum techniques[4] where the energy of the signal is spread across a very wide bandwidth. [paja rev3-] Another important class of anti-jamming techniques is the channel hopping [5, 6] where signal transmission channel is changing over time. While spread spectrum [paja rev3-] (a) Figure : (a) Jammer s Energy efficiency vs. Censorship ratio and (b) Energy efficiency vs. Stealth (b)

5 and frequency hopping techniques are important physical layer mechanisms for combating jamming, additional protection is required at the packet-level. As in the case of standard wireless protocols such as IEEE 82. and Bluetooth, the jammer may know the pseudo-random noise code or frequency hopping sequence. Furthermore, even if no information about the spread spectrum protocol is available to the jammer, it can still destroy a small number of bits in each transmitted packet by sending a strong jamming signal of short duration. There have been several efforts to make communication in sensor networks more robust in the presence of a jammer. In [6], Wood et al. described DEEJAM, a link layer protocol that includes several schemes for robust IEEE based communication for reactive and random jammers. While mechanisms such as coding and fragmentation are proposed, the jammer still has a competitive advantage in that it may increase the power of its jamming signal and a single jamming signal is capable of jamming multiple links in the vicinity. The authors assume that reactive jammers can be considered energy-efficient. Current radio transceivers with the IEEE physical layer of communication, use almost the same, if not greater, energy for receiving as they do for transmission [7]. In cases where resilience to jamming is not possible, it is useful to detect and estimate the extent to which the jammer has influence over the network. A jammed-area mapping protocol is described in [8] which can be used to delineate regions affected by a jammer. Such information can ultimately be used for network routing. One of the requirements of the protocol is that every node knows its own position along with positions of all its neighbors. Our proposed solution, WisperNet, does not require such position and direction information and directly computes routes with the highest end-to-end packet delivery rate. 2.2 Impact of Jamming on MAC Protocols We now investigate the characteristics of different classes of sensor network link protocols and the impact of a jammer on each class Energy-Efficient MAC Protocols Several MAC protocols have been proposed for low-power operation for multi-hop wireless mesh networks. Such protocols may be categorized by their use of time synchronization as asynchronous [9], loosely synchronous [, ] and fully synchronized protocols [2, 3]. In general, with a greater degree of synchronization between nodes, packet delivery is more energy-efficient due to the minimization of idle listening when there is no communication, better collision avoidance and elimination of overhearing of neighbor conversations. Asynchronous protocols such as Carrier Sense Multiple Access (CSMA) are susceptible to jamming both at the transmitter (busy channel indication) and at the receiver (energy Figure 3: RT-Link time slot allocation with out-ofband synchronization pulses drain). The Berkeley MAC (B-MAC) [9] protocol performs the best in terms of energy conservation and simplicity in design. B-MAC supports CSMA with low power listening (LPL) where each node periodically wakes up after a sample interval and checks the channel for activity for a short duration of.25ms. If the channel is found to be active, the node stays awake to receive the payload following an extended preamble. Using this scheme, nodes may efficiently check for neighbor activity while maintaining no explicit schedule which a statistical jammer may exploit. Loosely-synchronous protocols such as S-MAC [] and T-MAC [4] employ local sleep-wake schedules know as virtual clustering between node pairs to coordinate packet exchanges while reducing idle operation. Both schemes exchange synchronizing packets to inform their neighbors of the interval until their next activity and use CSMA prior to transmissions. S-MAC results in clustering of channel activity and is hence vulnerable to a statistical jammer. Synchronous protocols such as RT-Link [3], utilize hardware based time synchronization to precisely and periodically schedule activity in well-defined TDMA slots. RT-Link utilizes an out-of-band synchronization mechanism using an AM broadcast pulse. Each node is equipped with two radios - an AM receiver for time synchronization and an transceiver for data communication. A central synchronization unit periodically transmits a 5μs AM sync pulse. Each node wakes up just before the expected pulse epoch and synchronizes the operating system upon detecting the pulse. As the out-of-band sync pulse is a high-power signal with no encoded data, it is not easily jammed by a malicious sensor node. In general, RT-Link outperforms B-MAC which in turn outperforms S-MAC in terms of battery life across all event intervals [3]. Figure 2 shows the relative node lifetimes for 2AA batteries and similar transmission duty cycles. Here node lifetimes for CSMA, S-MAC, B-MAC, and RT-link are.9,.54,.78 and 3 years respectively for a network of nodes with a s event sample period. While RT-Link nodes communicate in periodic and well-defined fixed-size time slots as shown in Figure 3, a statistical jammer is able to easily determine the channel activity schedule and duration of each scheduled transmission. As shown in Figure 4, an attacker can glean the channel activity pattern by scanning the channel and sched- Figure 2: Comparison of robustness to jamming and energy efficient operation of sensor MAC protocols Figure 4: An attacker can learn node schedules and selectively jam active time slots

6 Probability.6.4 Probability Interarrival times [ms] Figure 5: SMAC PDF for 5% utilization ule a jamming signal to coincide with the packet preamble at the start of a time slot Statistical Jamming We focus on the statistical jammer s performance with S- MAC and RT-Link as both result in explicit patterns in packet inter-arrival times. We do not consider B-MAC as we aim to leverage the more energy-efficient RT-Link as a base synchronized link-layer mechanism for WisperNet. We simulated a network of nodes in each case, with a 3ms average transmission duration. In the case of S-MAC, we observe that all nodes quickly converge on one major activity period of 25ms. In Figure 5, we also notice a spike close to 2ms. This is the interval between the transmission of control packets and data packets at the start of an activity period. In the case of RT- Link, we simulated four flows with different rates and hence observe 4 distinct spikes in Figure 6. The other spikes with lower intensity are harmonics due to multiples of 32 slots in a frame. In both cases we observe distinct inter-arrival patterns which enable a statistical jammer to efficiently attack both protocols. Our goal with WisperNet is to develop coordinated randomized schedules, packet sizes and routes such that a statistical jammer is unable to extract any distinctive features from the packet inter-arrival distribution. 2.3 Assumptions We make several assumptions in the design and evaluation of WisperNet. We assume the jammer is as energyconstrained as a legitimate node and must maintain a stealth operation with a low duty-cycle. All packets exchanged between nodes are encrypted with a group key shared by legitimate nodes and hence the jammer is not protocol-aware. We consider both malicious and non-malicious jamming and do not differentiate between them as the anti-jamming mechanisms are native to the link and network protocol. The transmission power is dbm (mw) and in the worst case (with maximum power link jamming) the nominal packet delivery rate is never below 2%. This has been demonstrated in previous experiments [3]. For simplicity, we presume that interference range is equal to the transmission range of one hop. This restriction does not limit our results. We assume all communication is between a central gateway and each of the nodes across one or more hops. In this section we showed that statistical jammers, which exploit the observed temporal patterns in channel activity, are both more energy efficient than reactive and random jammers and more deceptive than constant jammers. With slot schedule and slot duration randomization, the statistical jammer s Interarrival times [ms] Figure 6: RT-Link PDF for 5% utilization efficiency is reduced to that of a random jammer. Random jammers, while relatively inefficient are still effective with censorship that increases linearly with link utilization. To avoid a random jammer, it is essential not to schedule nodes within the physical vicinity of the jamming source. We therefore have to employ temporal randomization to combat a statistical jammer followed by spatial route adaptation to avoid the resultant random jammer. Our goal is to develop a protocol which, in the presence of a statistical jammer, has energyefficiency near that of RT-Link and a censorship ratio lower than that of a random jammer. 3. ANTI-JAMMING WITH COORDINATED SPATIO-TEMPORAL RANDOMIZATION An effective approach to diminish the impact of a statistical jammer on TDMA-based MAC protocols is to eliminate the possibility to extract patterns in communication. These patterns appear as a result of the use of fixed schedules which are set when a node joins a network and are assumed to repeat till the network is disbanded. Such simple and repetitive patterns are maintained with tight time synchronization and result in minimal energy consumption, deterministic end-toend delay and perhaps maximal transmission concurrency. In order to limit the impact of statistical jamming but still benefit from the above energy and timeliness performance, we maintain the time synchronization but change the schedule, transmission duration and routes in a randomized yet coordinated manner along small time scales. Two components of the WisperNet protocol are Coordinated Temporal Randomization (WisperNet-Time) and Coordinated Spatial Adaptation (WisperNet-Space), which perform different actions in the temporal and spatial domains respectively. WisperNet-Time is designed to defeat statistical jammers. By randomizing the communication in time, a statistical jammer s performance is reduced to that of a random jammer as the distribution of packet inter-arrival times is flat. No timing-based scheme can reduce the probability of being jammed by a random pulse jammer. In this case, the only way to decrease the jamming impact is by avoiding the jammed areas using WisperNet-Space. WisperNet-Space implements adaptive network routing as a jamming avoidance mechanism to use links which are less affected by the jammer, if possible. Both WisperNet-Time and WisperNet-Space incorporate online algorithms where the network is continuously monitored and node operations are adjusted in time and space. 3. WisperNet-Time: Co-ordinated Temporal Randomization The main requirement for the proposed protocol is the pro-

7 vision of tight time synchronization between nodes. In order to keep coordination between nodes, all nodes have to be informed about current network state in terms of current slot schedule, current slot duration and current active network topology. We achieve this by building upon the FireFly sensor network platform [5] and using the basic synchronization mechanisms adopted in the RT-Link protocol. As illustrated in Figure 3, all communication with RT-Link is in designated time slots. 32 time slots form a frame and 32 frames form a cycle. The time sync pulse is received once every cycle. Each FireFly node is capable of both hardware-based global time synchronization and software-based in-band time sync. A second requirement for WisperNet is that changes in state should require minimum gateway-to-node communication and no state information exchange between nodes. All communication must be encrypted and authenticated so that an eavesdropper may not be able to extract the logical state of the network. We describe the authentication and implicit coordination scheme in the following section and the synchronization mechanism in the Implementation section. 3.. Schedule Randomization The first step toward schedule randomization is a pruning of the physical network topology graph into a directed acyclical graph. Figure 7(a) shows an example network topology graph, where each edge represents physical wireless link between two nodes. The physical network topology is logically pruned by disabling desired links. In order to logically remove a link, a node is scheduled to sleep during that particular neighbor s transmission, thereby ignoring that transmission. By forming a directed acyclic graph we are able to efficiently assign noncolliding schedules that can be changed for every frame, as shown in Figure 7(b). Links marked by the dashed line are inactive but must be accounted for by any graph coloring algorithm. The algorithm for schedule randomization is organized in a distributed manner. Every node uses a Pseudo-Random Function (PRF) to obtain its transmission schedule from the current network key and its node ID. The transmission schedule consists of different slot indexes that can be used for transmission to neighboring nodes. The schedule changes for every frame (i.e. 32 slots) and during a frame, a node transmits only on the time-slots determined by its PRF output. After transmission, every node goes to sleep, setting its sleep timer to wake up for the earliest receive or transmit slot. In this way energy consumption is reduced to minimum. To obtain non-repeating schedules, but with full coordination between nodes, the PRF computed by every node uses the current active network key along with its node ID. Once in a cycle, between two synchronization pulses, the gateway broadcasts the active keys for the next cycle. The keys, which are members of the one-way key chain, are generated during gateway s initialization and are stored in its memory. All keys from this chain are calculated from randomly chosen last key K n by repeatedly applying one-way function F (as shown in Figure 8: Generation of keys at the gateway, using a one-way hash function. Figure 8): K j = F (K j+),j =,, 2,...n. As F is a one-way function, all previous members of chain (K,K,..., K j ) can be calculated from some chain element K j but subsequent chain members K j,k j+,..., K n [6] cannot be derived. This authentication scheme is similar to [7, 8] but its use for scheduling is new. We use the SHA-HMAC[9] keyed-hash function to generate the current slot schedule. Therefore, for schedule computation HMAC(ID,K j) is used, where K j presents currently active network key (member of the one-way key chain). SHA-HMAC outputs 6 bits which are used to specify the schedule of transmission slots for each of the 32 frames. These 6 bits are divided into 32 groups of 5-bits, where the node s transmit schedule in i-th frame (i =,, 2,...3) is determined by i-th group of 5 bits. These 5 bits represent the index of one of the 32 frame s slots, eventually used for transmission. Implicit Schedule Conflict Resolution This approach for determining the transmission schedule locally can introduce a problem of potential interference that may occur when neighboring nodes are assigned the same random slot. To prevent this, every node, in addition to its schedule, calculates a slot precedence (or priority) for every transmission. The precedence for the i-th frame s transmission schedule is determined by (32 i)-th 5 bits group (i.e. reverse order of the transmission schedule). Since there is an even number of frames, the transmission schedule and precedence are never extracted from same group of bits. Therefore, to compute its schedule in one sync period with 32 frames, each node has to calculate exactly one SHA-HMAC function for itself, and one SHA-HMAC per node for all nodes in its k-hop interference range. We assume the node IDs of all k- hop neighbors are known [paja rev3-2] (when node joins the network it broadcast its ID to all its neighbors in k-hop range) [paja] remove end of this sentencevia periodic HELLO packets with a TTL of k. Given the IDs for all nodes in its k-hop radius, a node calculates the schedule and precedence for all of neighbors as shown in Figure 9. After schedule conflicts are resolved implicitly based on the higher precedence, the node follows the combined transmit and receive schedule in a single vector. [paja rev2-] Proposed solution introduces some additional memory and pro- (a) Physical network topology (b) Logical network topology Figure 7: (a)example network topology (b)its collision-free transmit schedule from frame-to-frame Figure 9: Implicit conflict resolution

8 cessing requirements that will be considered in details in implementation section. The proposed slot conflict resolution can have minor inefficiencies when a node with a higher transmit precedence for a particular slot does not have any message to send, while the another node is not allowed to send its message in the same slot due to a lower precedence. This results in a lower end-toend bandwidth and an increase in a message delay. However, this issue has a fairly low probability of occurring in networks for sensor networks with a low to moderate duty cycle Slot size randomization The proposed schedule randomization prevents a statistical jammer from performing efficient jamming by transmitting pulse attacks in slots designated for nodes communication. However, even with the schedule randomization, an adversary is able to estimate slot sizes from the probability distribution function (PDF) of packet inter-arrival times [3]. This statistical jamming scheme allows the jammer to transmit short pulse attacks at beginning of each slot, therefore corrupting all communication attempts. Although this scheme is less energy efficient than a fixed schedule TDMA protocol, it is still more efficient than a random jammer. Slot size randomization is implemented in a similar manner to slot schedule randomization, using SHA-HMAC, as schedule randomization, but with one important difference. Instead of using the last revealed key for the slot size calculation, every node uses a shared predefined key, K slot,and thenetwork sstatecountercnt. Therefore, for slot size randomization the PRF is calculated as HMAC(cnt, K slot ). The cycle counter is transmitted in the header of each packet and is incremented every cycle. K slot is intentionally a local key so that a node joining the network will be able to synchronize its slot sizes after receiving one legitimate packet. The SHA-HMAC s output, which is also calculated for a frameby-frame basis, defines the slot size for next frame as shown in Figure. The network s state counter represents the number of synchronization pulses received by the network, and its value is exchanged between neighboring nodes in the header of every packet. Here we assume that every sync pulse is received as it is a global and high-power AM pulse, so it is only nodes who want to join an already operational network need to be informed about current network counter. The proposed coordinated slot size randomization scheme assures that all nodes know the current frame s slot sizes and allows them to calculate an accurate time interval for their transmissions/receptions. If a key from the key chain is used for slot size calculation instead predefined one, cases when node does not receive key from the gateway would result in complete loss of synchronization. Without correct information about a slot size, nodes that do not know the current frame size are not able to schedule themselves to wake-up for the expected sync pulse. [paja rev-2] With predefined key used for slot size calculations, nodes are always available to know size of each frame, therefore they are able to schedule it awakening on time. Slot sizes can have values from a discrete set, where the set size is determined by the number of bits output from the PRF. The number of values used for slot sizes and relative distance between them have direct influence on PDF of packet inter-arrivals times. Anti-jamming goal is to have a uniform PDF, or at least a PDF with spikes flattened as much as possible, which does not allow timing information extraction. It is recommended that at least 8 slot sizes with small relative difference between them be used. Slot size randomization requires additional memory resources if nodes need to send some fixed-size data block in a fixed time interval. In this case slot sizes can be both smaller and bigger than the size necessary for data block transmission, which can result in lower network utilization in former case or data congestion in later case. In the latter case, a portion of the data available for transmission will have to be buffered in node s internal queue till the next transmission slot occurs. Of course, in this case, the average slot size must be larger than slot size needed for one data block transmission. The size of the queue needed in every node is directly connected with ratio between these two sizes. 3.2 WisperNet-Time: Performance Analysis We now investigate the impact of channel utilization on the PDF of packet inter-arrival times. We also determine the buffering needs due to randomized slot sizing and its impact on the end-to-end delay. Finally we look at the censorship ratio vs. jammer s lifetime for RT-Link, S-MAC and Wisper- Net. We conducted a simulation in Matlab on a protocol with structure similar to RT-Link [3], where each cycle consists of 32 frames and each frame consists of 32 slots. At the beginning of every cycle a synchronization pulse is transmitted. We have simulated a system where slot sizes have uniform distribution with values in range [ 5]ms. A maximum slot size of 5ms is chosen to match the maximum message size of 28 bytes for IEEE transceiver with data rate of 25kbps[7]. 28 bytes can be sent with transmission duration of 4.2ms and the rest of the slot time is used for inter-slot processing and for guard times. A simulation for synchronization pulses (i.e. cycles) was carried out, which on an Probability Cumulative Distribution Interarrival times [ms].5 5% utilization 75% utilization 5% utilization 25% utilization Interarrival times [ms] Slot size randomization on a frame-by- Figure : frame basis Figure : (Top) PDF of inter-arrival times for WisperNet. (Bottom) Corresponding CDF.

9 average lasts 5 minutes. We first simulated the influence of the link utilization factor (U ) on the PDF of inter-arrival times and show that it has very little influence with the proposed scheme. This is one of the major benefits of WisperNet-Time, because for other protocols the only way to reduce spikes in the PDF is to reduce the utilization factor, as proposed in [3]. Results for PDF of inter-arrival times are shown in in Figure for three different utilization factor [paja rev3-3] utilization factor equal to 5%, where slot sizes were randomly chosen from one of the 32 possible values in desired span. Channel utilization has an effect on the PDF but in smaller scale comparing to B-MAC. With U below 5%, a small increment can be seen on spikes in (5 ]ms interval. Also with integer multiples of some slot sizes within [ 5]ms interval, influence of U can almost be ignored. Due to the uniform distribution for all three cases of U it is not possible to extract slot sizes. Even if the PDF is derived from a smaller statistical sample size, the results are similar due to the pseudo-randomness of the slot size. To analyze how the slot size changes affect the end-to-end delay, we simulated a -dimension chain with 2 nodes. In every frame, each node forwards the previously received data to next node. If the slot size is smaller than necessary to transmit the backlogged data, the maximum allowed packet size is sent and a rest of the data is buffered. In a simulated chain, the source node receives fixed size data blocks at a fixed interval and at a slightly smaller size than for an average slot size (e.g. 3ms). Figure 2 presents PDF and CDF of delay at last node for different slot s size quantizations. We observe that with finer quantization of slot sizes, the distribution interval of the last node has not only a smaller maximum delay but also a smaller possible set of delay values that can be expected. The reason is that finer quantization allows better data distribution per packets and therefore reduces the delay caused with packets fragmentation. Expectedly, this randomization introduced some additional delay. In a TDMA system with a constant slot size of 3ms, the delay at the last node would be 2 3ms =6ms. Here average delay is around 75ms, but with 95% probability interval [67 88]ms. This shows that randomization introduces some variability into the communication end-to-end delay estimation. Another potential side-effect of WisperNet-Time is a need for additional memory for data queuing. In Figure 3, the maximum queue size for every node in chain is presented. The first node, with its constant data block input, requires a buffer with an additional 52 bytes of memory. All other nodes require an additional buffer for one maximum sized packet. Fig. 4 presents the relationship between the jammer s lifetime (LIFE) and censorship ratio (CR) for communication in Probability [%] Cumulative Distribution % region Step.5 3 Step.2 2 Step Delay [ms].5 Step.5 Step.2 Step Delay [ms] Figure 2: Message delay and its Cumulative Distribution at last node, for 2 nodes chain its range. We simulated the influence of two types of jammers - statistical jammers (SJ) and random jammers (RJ) - on different kinds of protocols. Both these types of jammers transmit 5μs-long pulse attacks. We modeled these attacks with a 9% success rate of packet corruption in cases when jamming pulse is transmitted during node s communication. For RT-link and WisperNet-Time, we used the protocols previously described, while for Random Schedule TDMA (RST- DMA)weusedaprotocolalsowith32slotsperframe,where every slot is 3ms long. All protocols are simulated for systems with 25% of network utilization. As we expected, for RT-Link and S-MAC, the SJ s lifetime is very high. As shown, RSTDMA is easily jammed and the SJ enjoys the longest lifetime. In addition, the slot size randomization component decreases the jammer s lifetime, for almost. years at 5% CR. Note that differences between LIFE-CR curve for SJ and RJ are caused only by the fact that SJ does not transmit pulses in intervals smaller than ms, which, in this case, is the smallest slot size (only parameter that can be extracted from input signal statistics). We observe that schedule randomization has a significantly higher impact on the jammer s lifetime than does slot size randomization. This justifies our decision to use a pre-stored key for the latter s calculations, while using keys from the gateway s one-way chain for former. If some nodes are captured and compromised, only the predefined slot-size key would be risk being extracted. 4. WISPERNET-SPACE: COORDINATED SPATIAL ADAPTATION For WisperNet-Space, we consider a dense sensor network where each node is modeled as a unit disk graph. The network is represented as an undirected graph G(V,E) where V is a set of nodes (vertices) and E a set of links (edges). For each link e = e(u, v), k weights (or costs) w j(u, v), (j =, 2,..., k) are associated. For a tree T in graph G, the aggregate weight W j(t ) is defined as W j(t )= e T w j(e),j =, 2,..., k Weights associated with each link describe the different types of costs which may include the network s para-functional properties, such as reliability of network communication, or delay and energy consumption of a sensor network. In general a set L V of terminal nodes is given and the objective is to find a connected subgraph, spanning all the terminals with minimal aggregate weights for all j =, 2,...k. If only one weighting function is considered, L = T and the connected subgraph is required to be a tree, then the problem is defined as a Minimum Spanning Tree problem (MST). The MST problem can be solved using known algorithms (Kruskal s, Boruvka s, etc) [2]. If L T and also only one weighting functions is considered, problem is equivalent to Steiner minimal tree problem (SMT). SMT is a NP-complete problem, but several heuristics exist which resolve SMT problem in both a centralized and a distributed manner. For some application where more than one weighting function needs to Max Que Size [B] Node Figure 3: Maximum queue size for each node in 2 nodes chain

10 Censorship Ratio [%] (a) Jammer s Lifetime [years] Censorship Ratio [%] zoomed (b) Jammer s Lifetime [years] RSTDMA with Statistical Jammer WnT with Statistical Jammer WnT with Random Jammer RT Link with Statistical Jammer S MAC with Statistical Jammer Figure 4: (a) Dependency between jammer s lifetime and Censorship Ratio and (b) zoomed be defined, algorithms for multi-constrained routing are used in order to control all application s important para-functional properties of the network. For WisperNet-Space we only considered network s reliability, so we associate a reliability weight function for each link in network. We define the weight of each link to be a function of the packet loss ratio and hence aim to derive routes which connect all essential nodes with the most reliable links. By continually executing a cost minimization function, we are essentially able to avoid links under the influence of a random jammer. The network s reliability is measured in terms of its Packet Delivery Ratio (PDR) which is defined as the ratio of packets that are successfully delivered to a destination [2]. PDR can be perceived as the probability of error-free communication between two nodes. Thus, the reliability of a path P in the given network can be defined as a e P PDR(e). Our goal is to achieve maximum reliability on a path P,whichis equivalent to maximizing ln PDR(e) = lnp DR(e). e P e P With PDR(e) forpathp, our goal is to minimize e P lnp DR(e). Therefore, the reliability weight for some link e = e(u, v) is defined as w r(u, v) = lnp DR(u, v). For adaptive routing in WisperNet-Space, we use a MST- Steiner heuristic to solve the SMT problem. All active nodes periodically send the PDRs for all their active links to the gateway. After receiving a link s weight, the gateway updates its weight table for all existing links in the network. Since PDR is not defined for inactive (not used) links, these links keep same weights as before present network topology became valid. Their weights can not be reset to zero, since that would allow some heavily jammed links to become competitive for network routing right in next iteration. In order to defend against mobile jammers, the weights of unused network s links are processed in time with a leaky integrator. To avoid situations where some previously heavily jammed link still has a high weight although the jammer that caused it has moved away, for every link e = e(u, v) andthe current active subgraph T, the reliability weight for the next network topology calculation is defined as: { lnp DR(u, v),e T w r(u, v) = ρ w r(u, v),e / T ρ ( <ρ<) is a leaky constant that determines a speed of network s adaptation to jammers mobility. It is not recommended to set a too small value for ρ, since something similar to previously described situation can happen, when a jammed link can be repeatedly included in active topology after very short duration. [paja rev2-3] For example with ρ =.8 reliability weight for link that is not in use would be reduced by 2% for every calculation of network topology, which would allow inclusion of the jammed link into new topology after only a few iterations. If all jammers have fixed positions, ρ can be set to. [paja rev2-3 remove next sentence -> moved to performance analysisin our experiments we use a value of.999. After updating its weights table, the gateway calculates the new active topology with minimum costs to reach all Steiner points (i.e. active nodes). To distribute the information about active links, we used the Prufer code (sequence) [2], a unique sequence associated with a tree, which for a tree with N vertices contains N 2 elements. In addition to this code, we send a second code sequence that maps the node ID of the active nodes to the index of the N 2 sequence. In a case of dense networks, with N nodes, from which the Steiner tree is derived, a much smaller number of nodes (M) maybeactive. Therefore for all M nodes from the Steiner tree, different temporal IDs are assigned from : M interval, and for that tree, a Prufer code with M 2 elements is derived. Along with this sequence and number of active nodes, M, alook-up table with size M 2 is sent, where i-th position in this table contains ID of a node, that is indexed as i in the Prufer code sequence. In this way only 2 M values are sent from gateway and can be encapsulated within one maximum-sized 28 byte IEEE packet. This message from gateway is distributed over the network using all active links. Since some currently inactive nodes may be included into new active topology, the mechanism to inform them is included. All inactive nodes wake up after every sync pulse, and listen for first 8 slots in a frame. These 8 contention slots are used for new topology distribution. RT-Link supports both contention and contention-free slots and thus makes it convenient to include both scheduled and asynchronous control traffic. In our implementation, WisperNet-Space computes a new network topology every 24 sync pulses. 4. WisperNet-Space: Performance Analysis In order to evaluate the performance of WisperNet-Space under random jamming attacks we first simulated an SMT network with a random topology. A network with 4 randomly distributed nodes in a 4km x4km square was analyzed. We also randomly distributed nine jamming nodes, each with the same RF characteristics as network s nodes. To emphasize the jamming effect in order to test WisperNet-Space s adaptation, the jammers link utilization is set to 5%. We implemented a communication protocol so that all neighboring nodes exchange exactly one message per frame. Changes in network routes for both SMT and MST components are performed once in frames. [paja rev2-3 In our experiments we used a value of.999 for ρ. For this value reliability weight of unused link decreases % for every period of 96 seconds (on average). Figure 5(a) presents the initial network topology and the

11 (a) Network topology - beginning (b) Network topology at an intermediate time instance, t (c) Network topology - optimal Figure 5: Network topology; green links - actual, physical links; red - links used for Steiner tree; blue nodes - terminal nodes (members of set L); dark gray area - area under jammers influence initial routes. The terminal nodes (active nodes in the Steiner Tree) and areas under attack by the jammers are highlighted. We observe a large number of active links are under attack. The average censorship ratio for this network is 9% for this startup configuration. The censorship ratio decreases to less than % as the routes adapt to more realible paths. The censorship ratio can not go below this minimum value. This is because for the given Steiner tree topology and its distribution of jamming regions, the best case routes determiend by WisperNet-Space do include at least 2 partially jammed links. The optimal configuration includes links jammed in both direction and 2 links jammed in only one direction, as shown in Figure 6. We observed that at some intermediate moments (for example moments t and t 2 as seen in Figure 5(b) and corresponding Figure 7) network routes with more jammed links were chosen, which directly resulted in increase of the overall censorship ratio. This is more prominent at the beginning of the WisperNet-Space s operation when all links start with the same minimum weight (). We see in Figure 5(b), three links are jammed in both directions in the top-right corner. As the routing algorithm explores the problem space with different sets of active links, it often chooses links under heavy influence of the jammer. As this procedure of refining the route continues and more links are evaluated for the first time, the algorithm will choose jammed links only if its weight, due to the leaky integrator, drops below a threshold that would make the aggregate weight of a subgraph smaller than the aggregate weight of currently used subgraph. We observe these spikes in the networks censorship ration in Figure 7. Figure 5(c) presents optimal solution where only two links from highlighted area, jammed in only one direction, are used for routing. Over the course of the adaptation for one hour, we observer in Figure 8 that the number of active links does not vary much. We also noticed the stretch factor of the network path lengths is.3 due to the end-to-end weight minimization function for calculating cumulative packet reliability across multiple links. 5. IMPLEMENTATION AND EVALUATION The WisperNet anti-jamming protocol was implemented on a network of FireFly sensor nodes. Each node consists of a microcontroller, an GHz transceiver and multiple sensors. Figure 2 shows two configurations of the FireFly node - one with in-band software-based time synchronization and the other with an add-on AM radio receiver for receiving an out-of-band AM sync pulse. In order to achieve the highly accurate time synchronization required for TDMA at a packet level granularity, we use a carrier-current AM transmitter to provide an out-of-band time synchronization pulse. The time synchronization transmitter plugged into the wall-outlet and used the building s power grid as an extended AM antenna and was thus able to cover the entire building. Nodes were synchronized with a 5μs pulse that was transmitted every seconds from the AM transmitter (see [5] for details). We implemented our jamming avoidance scheme incorporating SHA, SHA-HMAC, gateway schedule updates and neighbor information exchange in 8-bit fixed-point C for the Atmel ATMEGA32L microcontroller and a 6-bit 6MHz TI MSP43F22x microcontroller[2]. Each node ran the nano- RK[22] real-time operating system and the RT-Link[3] link protocol. The RT-Link TDMA cycle includes 32 frames which in turn are composed of 32 slots. The slot size were assigned values from [ 5]ms. In our tests, every node attempts to transmit one message per frame. We observe that most of the current hardware platforms used for wireless sensor networks development are not CPUconstrained, but have a memory limitation. Our implementation of the SHA-HMAC function required only 3 additional 6-bit buffers as the comparison of schedules and precedences is done iteratively for all the node s neighbors. The Links Links 5 Number of links jammed in both direction t Number of links jammed in only one direction Frame number Figure 6: NumberAveraged of links Censorship jammed Ratio in 2/ direction used for communication Censorship ratio [%] t Network configurations Figure 7: Averaged network s censorship ratio on blocks, for implemented Steiner tree t2 t2

12 22 Number of links used for communication 2 Links Frame number Figure 8: Number of links used for communication SHA-HMAC function required 2.5ms for calculations on TI s MSP43F22x microcontroller. For networks where maximal node s degree in a network is N, every node, in the worst case, needs to execute SHA-HMAC function (N 2 +)times for schedule calculation and once more for slot size computation in every sync period. For example if N = 5, in worst case 27 SHA-HMAC function executions are needed, which results in 337.5ms of CPU time used for these calculations in every sync period, where one sync period contains = 24 slots, with sizes from ms to 5ms. Therefore in worst case less than 33% of CPU processing is used for these calculations, while on average less than % is used. From perpective of memory constraints, the implemented procedure for schedule randomization uses 276 bytes of flash memory and 4 bytes of RAM. Since only two nodes schedules have to be available at the same, schedule calculation procedure occupies only 236 byts for code size, along with additional 4 bytes of data pre-stored in FLASH. As same code is used for slot size randomization, and since this procedure is called after previous calculations, no additional memory is needed for slot size computation. In Figure 9, we connected three nodes to the oscilloscope to display the transmit and receive activity. Two nodes were programmed to be a transmit and receive pair to show the coordinated and collision-free schedule randomization. A third node was programmed to raise a signal on every slot to provide a reference of the slot boundaries. In Figure 2, the top signal on the oscilloscope is triggered by the transmit pin of the transmitter and the middle signal is triggered by the receive pin on the receiver. The signal at the bottom is triggered on every slot interval to provide a reference of the slot boundaries. We observe that the schedule is both coordinated and changes on a frame-by-frame basis. 6. DISCUSSION AND CONCLUSION Jamming, whether malicious or due to unintended interference, results in a loss of link reliability, increased energy consumption, extended packet delays and disruption of endto-end routes. Resilience to jamming and its avoidance, collectively termed as anti-jamming, is a hard practical problem as the jammer has an unfair advantage in detecting legitimate communication activity and simultaneously attacking multiple links due to the broadcast nature of the channel. In the context of energy-constrained sensor networks, the goal of the link protocol is to maximize the common sleep time between nodes. This results in node schedules with predictable patterns - making it an easy target for a statistical jammer. In this paper we proposed the WisperNet anti-jamming protocol which uses Coordinated Temporal Randomization Figure 2: FireFly nodes with AM sync module of transmissions (WisperNet-Time) to reduce the censorship ratio of a statistical jammer to that of a random jammer. A second component of WisperNet is Coordinated Spatial Adaptation (WisperNet-Space), where network routes are adapted continually to avoid jammed regions (and hence random jammers) and select paths with the max packet delivery ratio. We observe some limitations with our current implementation. The WisperNet-Spatial routing scheme is centralized and will not scale well in large networks (>5 nodes) under moderate to heavy attack as the message from the gateway may not get through. While several distributed heuristics for the MST problem exist, they require a large amount of information with respect to shortest paths from a node to all other nodes in the network. These schemes are not conducive to energy-constrained and memory-constrained sensor networks. We aim to explore distributed solutions further. A second limitation is that all non-active nodes in the MST are required to receive for few contention slots (i.e. 8 in our implementation) every cycle to receive and forward a route update message. This may be wasteful if the network is not under heavy attack from jammers. Through simulation and experiments, we demonstrate that WisperNet is able to effectively reduce the impact of statistical and random jammers. Unlike coding-based schemes, WisperNet is resilient to jamming even under moderate to high link utilization with 2% censorship rate for the network topologies explored in this work. The schedules derived from WisperNet are non-repeating, with randomized packet lengths while maintaining coordinated and collision-free communication. WisperNet has been implemented on a network of FireFly sensor nodes with tightly synchronized operation and low operation overhead. 7. REFERENCES [] W. Xu, W. Trappe, Y. Zhang, and T. Wood. The feasibility of launching and detecting jamming attacks in wireless networks. In ACM MobiHoc, 25. [2] W. Xu, T. Wood, W. Trappe, and Y. Zhang. Channel Surfing and Spatial Retreats: Defenses against Wireless Denial of Service. In ACM WiSe, pages 8 89, 24. [3] Y. W. Law et al. Energy-efficient link-layer jamming attacks against wireless sensor network MAC protocols. In ACM SASN, pages 76 88, 25. [4] A. J. Viterbi. Spread Spectrum Communications: Myths and Realities. In IEEE Comm. Magazine, 22. [5] V. Navda, A. Bohra, S. Ganguly, and D. Rubenstein. Using Channel Hopping to Increase 82. Resilience to Jamming Attacks. In INFOCOM, 27. Figure 9: Experimental setup with 3 FireFly nodes Figure 2: Implementation of WisperNet-Time showing changing patterns on a frame-by-frame basis